The HTTPS site sends no Content-Security-Policy header.

CSP_MISSING · Severity: Info

• InfoCSP_MISSING

  The HTTPS site sends no Content-Security-Policy header.

  A Content Security Policy limits where scripts, styles and frames may come from and reduces the damage of cross-site scripting. A Report-Only policy is not enforced and does not count. Whether a page needs one depends on what it does.

Reported by

• Security headers check
• Site health check

Available through the API

• Security headers check API
• Site health check API

Related findings

• Info CSP_UNSAFE_INLINE The Content Security Policy allows inline or eval'd scripts.

All findings